<!DOCTYPE html>
<html lang="en">

<head>
	<meta charset="UTF-8">
	<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
	<meta name="keywords" content="Authentication" />
	<meta name="description" content="Authentication" />
	<!-- 网页标签标题 -->
	<title>Authentication</title>
	<link rel="shortcut icon" href="https://img.alicdn.com/tfs/TB1hgJpHAPoK1RjSZKbXXX1IXXa-64-64.png"/>
	<link rel="stylesheet" href="/build/documentation.css" />
</head>
<body>
	<div id="root"><div class="documentation-page" data-reactroot=""><header class="header-container header-container-normal"><div class="header-body"><a href="/en-us/index.html"><img class="logo" src="/img/nacos_colorful.png"/></a><div class="search search-normal"><span class="icon-search"></span></div><span class="language-switch language-switch-normal">中</span><div class="header-menu"><img class="header-menu-toggle" src="/img/menu_gray.png"/><ul><li class="menu-item menu-item-normal"><a href="/en-us/index.html">HOME</a></li><li class="menu-item menu-item-normal menu-item-normal-active"><a href="/en-us/docs/quick-start.html">DOCS</a></li><li class="menu-item menu-item-normal"><a href="/en-us/blog">BLOG</a></li><li class="menu-item menu-item-normal"><a href="/en-us/community">COMMUNITY</a></li><li class="menu-item menu-item-normal"><a href="https://cn.aliyun.com/product/aliware/mse?spm=nacos-website.topbar.0.0.0">NACOS IN CLOUD</a><img class="menu-img" src="https://img.alicdn.com/tfs/TB1esl_m.T1gK0jSZFrXXcNCXXa-200-200.png"/></li><li class="menu-item menu-item-normal"><a href="http://console.nacos.io/nacos/index.html">DEMO-CONSOLE</a></li></ul></div></div></header><div class="bar"><div class="bar-body"><img src="/img/docs.png" class="front-img"/><div class="bar-title"><span>Documentation</span><div class="bone bone-light"></div></div><img src="/img/docs.png" class="back-img"/></div></div><section class="content-section"><div class="content-body"><div class="sidemenu"><div class="sidemenu-toggle"><img src="https://img.alicdn.com/tfs/TB1E6apXHGYBuNjy0FoXXciBFXa-200-200.png"/></div><ul><li class="menu-item menu-item-level-1"><span>Nacos </span><ul><li style="height:180px;overflow:hidden" class="menu-item menu-item-level-2"><span>What is Nacos<img style="transform:rotate(0deg)" class="menu-toggle" src="/img/arrow_down.png"/></span><ul><li class="menu-item menu-item-level-3"><a href="/en-us/docs/what-is-nacos.html" target="_self">What is Nacos</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/concepts.html" target="_self">Concepts</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/architecture.html" target="_self">Architecure</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/feature-list.html" target="_self">Feature list</a></li></ul></li><li style="height:324px;overflow:hidden" class="menu-item menu-item-level-2"><span>Quick Start<img style="transform:rotate(0deg)" class="menu-toggle" src="/img/arrow_down.png"/></span><ul><li class="menu-item menu-item-level-3"><a href="/en-us/docs/quick-start.html" target="_self">Nacos</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/quick-start-spring.html" target="_self">Nacos Spring</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/quick-start-spring-boot.html" target="_self">Nacos Spring Boot</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/quick-start-spring-cloud.html" target="_self">Nacos Spring Cloud</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/quick-start-docker.html" target="_self">Nacos Docker</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/use-nacos-with-dubbo.html" target="_self">Nacos with Dubbo</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/use-nacos-with-kubernetes.html" target="_self">Nacos with K8s</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/nacos-sync.html" target="_self">Nacos Sync</a></li></ul></li><li style="height:288px;overflow:hidden" class="menu-item menu-item-level-2"><span>User Guide<img style="transform:rotate(0deg)" class="menu-toggle" src="/img/arrow_down.png"/></span><ul><li class="menu-item menu-item-level-3"><a href="/en-us/docs/sdk.html" target="_self">Java SDK</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/other-language.html" target="_self">Other Language</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/open-api.html" target="_self">Open-API</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/nacos-spring.html" target="_self">Nacos Spring</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/system-configurations.html" target="_self">Nacos System Configurations</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/auth.html" target="_self">Authentication</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/faq.html" target="_self">FAQ</a></li></ul></li><li style="height:36px;overflow:hidden" class="menu-item menu-item-level-2"><span>Admin Guide<img style="transform:rotate(-90deg)" class="menu-toggle" src="/img/arrow_down.png"/></span><ul><li class="menu-item menu-item-level-3"><a href="/en-us/docs/deployment.html" target="_self">Deployment Guide</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/cluster-mode-quick-start.html" target="_self">Cluster Mode Deployment</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/management-api.html" target="_self">Management OpenAPI</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/console-guide.html" target="_self">Admin Console Guide</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/monitor-guide.html" target="_self">Nacos Monitor Guide</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/nacos-config-benchmark.html" target="_self">Nacos Config Benchmark</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/nacos2-config-benchmark.html" target="_self">Nacos2.0 Config Benchmark</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/nacos-naming-benchmark.html" target="_self">Nacos Naming Benchmark</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/nacos2-naming-benchmark.html" target="_self">Nacos2.0 Naming Benchmark</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/nacos-sync-use.html" target="_self">Data Migration to Nacos</a></li></ul></li><li style="height:36px;overflow:hidden" class="menu-item menu-item-level-2"><span>Nacos 2.0<img style="transform:rotate(-90deg)" class="menu-toggle" src="/img/arrow_down.png"/></span><ul><li class="menu-item menu-item-level-3"><a href="/zh-cn/docs/2.0.0-alpha.html" target="_self">2.0-BETA</a></li><li class="menu-item menu-item-level-3"><a href="/zh-cn/docs/2.0.0-upgrading.html" target="_self">Upgrading</a></li></ul></li><li style="height:36px;overflow:hidden" class="menu-item menu-item-level-2"><span>Contributor Guide<img style="transform:rotate(-90deg)" class="menu-toggle" src="/img/arrow_down.png"/></span><ul><li class="menu-item menu-item-level-3"><a href="/en-us/docs/contributing.html" target="_self">Contribute to Nacos</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/contributing-flow.html" target="_self">Contributing Flow</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/pull-request.html" target="_self">Pull Request Template</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/how-to-reporting-bugs.html" target="_self">How to report bugs</a></li></ul></li><li style="height:36px;overflow:hidden" class="menu-item menu-item-level-2"><span>Community<img style="transform:rotate(-90deg)" class="menu-toggle" src="/img/arrow_down.png"/></span><ul><li class="menu-item menu-item-level-3"><a href="/en-us/docs/community.html" target="_self">Community</a></li><li class="menu-item menu-item-level-3"><a href="/en-us/docs/nacos-dev.html" target="_self">Develop Team</a></li></ul></li></ul></li></ul></div><div class="doc-content markdown-body"><h1>Authentication</h1>
<h2>Attention</h2>
<ol>
<li>Nacos is defined as an IDC internal application component, not a product for the public network environment. It is not recommended expose it to the public network environment directly.</li>
<li>The simple authentication implementation provided by the Nacos community is just to start a discussion. The original intention is a weak authentication system to prevent affects others by misuse, not a strong authentication system to prevent malicious attacks. The requests that Nacos receives by default are all running in your trusted network environment.</li>
<li>As a non-core features, Nacos authentication will optimize the expansion in the future to facilitate companies with strong authentication needs to expand under their own security system. Nacos' community authentication implementation can be regarded as a simple authentication demo. Only for reference.</li>
<li>Welcome community security experts to contribute to the authentication and security content.</li>
</ol>
<h2>Use Authentication in Servers</h2>
<h3>Without Docker</h3>
<p>By default, no login is required to start following the official document configuration, which can expose the configuration center directly to the outside world. However, if the authentication is enabled, one can use nacos only after he configures the user name and password.</p>
<p>Before enabling authentication, the configuration in application.properties is as follow:</p>
<pre><code class="language-java">### If turn on auth system:
nacos.core.auth.enabled=false
</code></pre>
<p>After enabling authentication, the configuration in application.properties is as follow:</p>
<pre><code class="language-java">### If turn on auth system:
nacos.core.auth.enabled=true
</code></pre>
<h3>With Docker</h3>
<h4>Official images</h4>
<p>If you choose to use official images, please add the following environment parameter when you start a docker container.</p>
<pre><code class="language-powershell">NACOS_AUTH_ENABLE=true
</code></pre>
<p>For example, you can run this command to run a docker container with Authentication:</p>
<pre><code class="language-powershell">docker run -<span class="hljs-literal">-env</span> PREFER_HOST_MODE=hostname -<span class="hljs-literal">-env</span> MODE=standalone -<span class="hljs-literal">-env</span> NACOS_AUTH_ENABLE=true <span class="hljs-literal">-p</span> <span class="hljs-number">8848</span>:<span class="hljs-number">8848</span> nacos/nacos<span class="hljs-literal">-server</span>
</code></pre>
<p>Besides, you can also add the other related enviroment parameters:</p>
<table>
<thead>
<tr>
<th>name</th>
<th>description</th>
<th>option</th>
</tr>
</thead>
<tbody>
<tr>
<td>NACOS_AUTH_ENABLE</td>
<td>If turn on auth system</td>
<td>default :false</td>
</tr>
<tr>
<td>NACOS_AUTH_TOKEN_EXPIRE_SECONDS</td>
<td>The token expiration in seconds</td>
<td>default :18000</td>
</tr>
<tr>
<td>NACOS_AUTH_TOKEN</td>
<td>The default token</td>
<td>default :SecretKey012345678901234567890123456789012345678901234567890123456789</td>
</tr>
<tr>
<td>NACOS_AUTH_CACHE_ENABLE</td>
<td>Turn on/off caching of auth information. By turning on this switch, the update of auth information would have a 15 seconds delay.</td>
<td>default : false</td>
</tr>
</tbody>
</table>
<h4>Custom images</h4>
<p>If you choose to use custom images, please modify the application.properties before you start nacos, change this line</p>
<pre><code>nacos.core.auth.enabled=false
</code></pre>
<p>into</p>
<pre><code>nacos.core.auth.enabled=true
</code></pre>
<h2>Authentication in Clients</h2>
<h3>Authentication in Java SDK</h3>
<p>The user name and password should be set when creating a 'Properties' class.</p>
<pre><code class="language-java">properties.put(<span class="hljs-string">"username"</span>,<span class="hljs-string">"${username}"</span>);
properties.put(<span class="hljs-string">"password"</span>,<span class="hljs-string">"${password}"</span>);
</code></pre>
<h4>Example Code</h4>
<pre><code class="language-java"><span class="hljs-keyword">try</span> {
    <span class="hljs-comment">// Initialize the configuration service, and the console automatically obtains the following parameters through the sample code.</span>
	String serverAddr = <span class="hljs-string">"{serverAddr}"</span>;
	Properties properties = <span class="hljs-keyword">new</span> Properties();
	properties.put(<span class="hljs-string">"serverAddr"</span>, serverAddr);

    <span class="hljs-comment">// if need username and password to login</span>
        properties.put(<span class="hljs-string">"username"</span>,<span class="hljs-string">"nacos"</span>);
        properties.put(<span class="hljs-string">"password"</span>,<span class="hljs-string">"nacos"</span>);

	ConfigService configService = NacosFactory.createConfigService(properties);
} <span class="hljs-keyword">catch</span> (NacosException e) {
    <span class="hljs-comment">// TODO Auto-generated catch block</span>
    e.printStackTrace();
}
</code></pre>
<h3>Authentication in Other languages SDK</h3>
<p>Pending...</p>
<h3>Authentication in Open-API</h3>
<p>Firstly, the user name and password should be provided to login.</p>
<pre><code class="language-plain">curl -X POST '127.0.0.1:8848/nacos/v1/auth/login' -d 'username=nacos&amp;password=nacos'
</code></pre>
<p>If the user name and password are correct, the response will be:</p>
<pre><code>{&quot;accessToken&quot;:&quot;eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTYwNTYyOTE2Nn0.2TogGhhr11_vLEjqKko1HJHUJEmsPuCxkur-CfNojDo&quot;,&quot;tokenTtl&quot;:18000,&quot;globalAdmin&quot;:true}
</code></pre>
<p>Secondly, when using configuration services or naming services, accessToken in the previous response should be provided. To use the accessToken, 'accessToken=${accessToken}' should be appended at the end of request url, e.g.,</p>
<pre><code class="language-plain">curl -X GET '127.0.0.1:8848/nacos/v1/cs/configs?accessToken=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTYwNTYyMzkyM30.O-s2yWfDSUZ7Svd3Vs7jy9tsfDNHs1SuebJB4KlNY8Q&amp;dataId=nacos.example.1&amp;group=nacos_group'
</code></pre>
<pre><code class="language-plain">curl -X POST 'http://127.0.0.1:8848/nacos/v1/ns/instance?accessToken=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTYwNTYyMzkyM30.O-s2yWfDSUZ7Svd3Vs7jy9tsfDNHs1SuebJB4KlNY8Q&amp;port=8848&amp;healthy=true&amp;ip=11.11.11.11&amp;weight=1.0&amp;serviceName=nacos.test.3&amp;encoding=GBK&amp;namespaceId=n1'
</code></pre>
<h2>Open feature for server identity</h2>
<p>After the authentication feature is enabled, requests between servers will also be affected by the authentication system. Considering that the communication between the servers should be credible, during the 1.2~1.4.0 version, Nacos server use whether the User-Agent includes Nacos-Server to determine whether the request comes from other servers.</p>
<p>However, this implementation is too simple and fixed, leading to possible security issues. Therefore, since version 1.4.1, Nacos has added the server identification feature. Users can configure the identity of the server by themselves, and no longer use User-Agent as the judgment standard for server requests.</p>
<p>Way to open server identity</p>
<pre><code>### Open authentication
nacos.core.auth.enabled=true

### Shutdown user-agent judgement for server request
nacos.core.auth.enable.userAgentAuthWhite=false

### Config the server identity key(not empty) and value(not empty)
nacos.core.auth.server.identity.key=example
nacos.core.auth.server.identity.value=example
</code></pre>
<p>** Attention ** All servers in cluster need to be configured with the same <code>server.identity</code> information, otherwise it may cause data inconsistency between servers or failure to delete instances.</p>
<h3>Upgrade from old version</h3>
<p>Considering that users of the old version need to upgrade, users can turn on the <code>nacos.core.auth.enable.userAgentAuthWhite=true</code> during upgrading, and turn off it after the cluster is upgraded to 1.4.1 completely and runs stably.</p>
</div></div></section><footer class="footer-container"><div class="footer-body"><img src="/img/nacos_gray.png"/><div class="cols-container"><div class="col col-12"><h3>Vision</h3><p>By providing an easy-to-use service infrastructure such as dynamic service discovery, service configuration, service sharing and management and etc., Nacos help users better construct, deliver and manage their own service platform, reuse and composite business service faster and deliver value of business innovation more quickly so as to win market for users in the era of cloud native and in all cloud environments, such as private, mixed, or public clouds.</p></div><div class="col col-6"><dl><dt>Documentation</dt><dd><a href="/en-us/docs/what-is-nacos.html" target="_self">Overview</a></dd><dd><a href="/en-us/docs/quick-start.html" target="_self">Quick start</a></dd><dd><a href="/en-us/docs/contributing.html" target="_self">Developer guide</a></dd></dl></div><div class="col col-6"><dl><dt>Resources</dt><dd><a href="/en-us/community/index.html" target="_self">Community</a></dd><dd><a href="https://cn.aliyun.com/product/aliware/mse?spm=nacos-website.topbar.0.0.0" target="_self">Cloud Service MSE</a></dd><dd><a href="https://www.aliyun.com/product/edas?source_type=nacos_pc_20181219" target="_self">Cloud Service EDAS</a></dd><dd><a href="https://www.aliyun.com/product/ahas?source_type=nacos_pc_20190225" target="_self">Cloud Service AHAS</a></dd></dl></div></div><div class="copyright"><span>@ 2018 The Nacos Authors | An Alibaba Middleware (Aliware) Project</span></div></div></footer></div></div>
	<script src="https://f.alicdn.com/react/15.4.1/react-with-addons.min.js"></script>
	<script src="https://f.alicdn.com/react/15.4.1/react-dom.min.js"></script>
	<script>
		window.rootPath = '';
  </script>
	<script src="/build/documentation.js"></script>
</body>
</html>